CVE-2024-50704
📋 TL;DR
This is a critical unauthenticated remote code execution vulnerability in Uniguest Tripleplay software. Attackers can execute arbitrary code on affected systems by sending a specially crafted HTTP POST request without any authentication. Organizations running vulnerable versions of Tripleplay are at immediate risk.
💻 Affected Systems
- Uniguest Tripleplay
📦 What is this software?
Tripleplay by Uniguest
Tripleplay by Uniguest
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to install malware, steal data, pivot to internal networks, and maintain persistent access.
Likely Case
Attackers deploy ransomware, cryptominers, or backdoors to control affected systems and potentially move laterally within the network.
If Mitigated
With proper network segmentation and monitoring, impact could be limited to the affected Tripleplay system only.
🎯 Exploit Status
Unauthenticated exploitation with simple HTTP POST request makes this easily weaponizable.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 24.2.1
Vendor Advisory: https://uniguest.com/cve-bulletins/
Restart Required: Yes
Instructions:
1. Download Tripleplay version 24.2.1 from Uniguest portal. 2. Backup current configuration. 3. Install the update following vendor instructions. 4. Restart the Tripleplay service/system.
🔧 Temporary Workarounds
Network Isolation
allRestrict network access to Tripleplay systems using firewall rules
Web Application Firewall
allDeploy WAF with rules to block suspicious HTTP POST requests
🧯 If You Can't Patch
- Immediately isolate affected systems from internet and restrict internal network access
- Implement strict network monitoring for suspicious HTTP POST requests to Tripleplay endpoints
🔍 How to Verify
Check if Vulnerable:
Check Tripleplay version via admin interface or system information. If version is below 24.2.1, system is vulnerable.Check Version:
Check via Tripleplay web interface or consult vendor documentation for version check command.Verify Fix Applied:
Confirm Tripleplay version is 24.2.1 or higher after patching.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP POST requests to Tripleplay endpoints
- System process creation from web service user
- Failed authentication attempts followed by successful POST requests
Network Indicators:
- HTTP POST requests with unusual payloads to Tripleplay ports
- Outbound connections from Tripleplay systems to unknown IPs
SIEM Query:
source="tripleplay" AND (http_method="POST" AND (uri_path CONTAINS "/api/" OR uri_path CONTAINS "/admin/") AND size_bytes>1000)